Has anyone implemented ingesting the Audit logs from Mimecast into Graylog?

Are there any tips you would be willing to share? We are looking to create a Graylog Alert/Rule from ingested Mimecast Outbound audit logs to detect when a user sends more the 100 emails over a 15 min window of time. this would generally be indicative of a compromised account that is sending spam to other users.